Hi Dan, thank you for your useful video. In the "SecurityConfig" class, the `jwt()` method in `OAuth2ResourceServerConfigurer` has been deprecated since version 6.1. To resolve this, I used the `.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))` configuration and it worked for me.
Hi Dan, great video as always. I have one question though. At 17:00, when creating a @Bean for JwtDecoder, in SecretKeySpec constructor, you are setting "RSA" as alghoritm. Correct me if I'm wrong, but isn't that an asymmetric key encription? Shouldn't we pass something like HmacSHA512? Thanks in advance
Great video, this is what we needed. It would be great if you can build on top of this one so UsernamePasswordAuthenticationFilter is used along with PostgresDB!
Hi Dan! (sorry for my bad English). I have watched carefully some of your videos about security, there is one small problem: when restarting the application all the tokens previously issued become invalid. I will be very glad and grateful if you tell me how to solve this problem or make a video like "jwt for production"! I am immensely grateful for your channel, thank you!
In the given implementation we are using basic login where credential is supplied using authorize header but if we want to do so by using a rest end point how can I do that, anyone please guide.
Thank you so much for this short and concise tutorial Dan. However, I encountered an error while following along with the tutorial. I get an error when I try to encode with HS512 algorithm. HS256 works fine. The error is below [Request processing failed: org.springframework.security.oauth2.jwt.JwtEncodingException: An error occurred while attempting to encode the Jwt: Failed to sign the JWT -> The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]] with root cause com.nimbusds.jose.JOSEException: The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]
Absolutely in love with this Spring Security series. It would be awesome to expand these lessons with the utilization of refresh tokens.
Hi Dan, thank you for your useful video. In the "SecurityConfig" class, the `jwt()` method in `OAuth2ResourceServerConfigurer` has been deprecated since version 6.1. To resolve this, I used the `.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))` configuration and it worked for me.
Thanks buddy! It helped.
Great timing! Just got instructions from my mentor to learn about JWT tomorrow, and implement it in my project! Thank you!
Great tutorial. Could you expand on this topic and demonstrate how to implement logout functionality and refresh tokens?
A followup video about refresh token would be awesome.
Hi Dan, great video as always.
I have one question though.
At 17:00, when creating a @Bean for JwtDecoder, in SecretKeySpec constructor, you are setting "RSA" as alghoritm.
Correct me if I'm wrong, but isn't that an asymmetric key encription?
Shouldn't we pass something like HmacSHA512?
Thanks in advance
Great video, this is what we needed.
It would be great if you can build on top of this one so UsernamePasswordAuthenticationFilter is used along with PostgresDB!
Thanks for video! But how to refresh key?
Nicely done, may I know your IDE theme?
He's using new beta layout in appearence. Enable beta will give new appearence to IDE just like this. Wanna know his theme also ;)
thank you so much sir
Could you please make a video on common exception library for Spring Webflux projects
Well done, Thanks Dan
And how to use the symmetric key If i have auth server and resource server in one app :) ?
What is the advantage of the JWT over just using basic auth here if both endpoints are in the same application?
Nice shirt. And lesson of course 👍
Hi Dan! (sorry for my bad English). I have watched carefully some of your videos about security, there is one small problem: when restarting the application all the tokens previously issued become invalid. I will be very glad and grateful if you tell me how to solve this problem or make a video like "jwt for production"! I am immensely grateful for your channel, thank you!
you would probably need to store your active tokens in a persistent data storage
Very cool, thank you!
In the given implementation we are using basic login where credential is supplied using authorize header but if we want to do so by using a rest end point how can I do that, anyone please guide.
Hey Dan, what is securityMatcher? How is that different from requestMatcher?
How would you write a refresh token method for that application?
Thank you so much for this short and concise tutorial Dan. However, I encountered an error while following along with the tutorial. I get an error when I try to encode with HS512 algorithm. HS256 works fine. The error is below
[Request processing failed: org.springframework.security.oauth2.jwt.JwtEncodingException: An error occurred while attempting to encode the Jwt: Failed to sign the JWT -> The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]] with root cause
com.nimbusds.jose.JOSEException: The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]
Had the same issue. Your key is probably not long enough.
Wow thanks for pointing that out
@@hschaeufler How do we generate the correct key?
Probably longer than needed, but with the openssl utility you can do the following
openssl rand -base64 64
Nicely done, Dan! Can you do a tutorial about oauth2Client + JWT?
Nice video!
Thanks
What's going on with ur teeth? Why are they so white?))